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Attorney Docket No. 2471 7-717 
IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 



In re Application of 
Michael A. Lloyd et. al. 
Application No.: Not yet assigned 
Filed: Herewith 

Title: Method And Apparatus For The 
Assessment And Optimization of Network 
Traffic 



Group Art Unit: Not yet assigned 
Examiner: Not yet assigned 



PRELIMINARY AMENDMENT 

Box Patent Application 

Assistant Commissioner for Patents 

Washington, DC 20231 

Sir: 

Prior to examination on the merits, please amend the application as indicated below. 
Reconsideration is respectfully requested in view of the below amendments and remarks. 
Please amend the above-identified application as follows: 
IN THE SPECIFICATION 

Please amend the Specification as follows: 

Please insert at page 1, line 3, after the Title: 

CROSS REFERENCE TO RELATED APPLICATION 
This application is the National Stage of PCT Application No. PCT/US01/32319, filed 
October 17, 2001; and is a continuation-in-part of PCT Application No. PCT/US01/32312, filed 
October 17, 2001; PCT Application No. PCT/US0 1/3 1259, filed October 5, 2001; PCT 
Application No. PCT/US0 1/3 1420, filed October 4, 2001 ; and PCT Application No. 
PCT/US0 1/3 1419, filed October 4, 2001; which are continuations-in-part of U.S. Application No. 
09/960,623, filed September 20, 2001; U.S. Application No. 09/903,423, filed July 10, 2001; 
U.S. Application No. 09/923,924, filed August 6, 2001; and U.S. Application No. 09/903,441, 
filed July 10, 2001; which claim the benefit of U.S. Provisional Application No. 60/275,206, 



C:\NRPORTBL\PALIBl\DH !\2 1 00238_1.DOC 



1 



filed March 12, 2001; and U.S. Provisional Application No. 60/241,450, filed October 17, 2000. 
These applications are hereby incorporated by reference--. 

Please replace the paragraph beginning at page 1, line 31, to page 2, line 2, with the 
following rewritten paragraph: 

— The performance aspects of network paths to any given address will often have similar 
characteristics of the network paths to a nearby address. However, the task of identifying address 
blocks which are acceptably similar in performance characteristic is subtle: network address 
ranges are typically not directly representative of the underlying network topology.— 

Please replace the paragraph beginning at page 6, line 6, with the following rewritten 
paragraph: 

— In some embodiments of this invention, the device can select flows on the basis of input 
other than performance, such as user input, or the cost of the link. That is, the user can specify the 
flows that need special treatment. Also, interface statistics can be obtained from network; using 
this input, quantities such as available bandwidth, cost of usage of the links, or link bandwidth 
can be computed. Those skilled in the art can identify other metrics based on which flow 
determination and treatment can be based. Flows can be diverted when a given threshold in such 
metrics (such as cost or available bandwidth) is detected.— 

Please replace the paragraph beginning at page 7, line 15, with the following rewritten 
paragraph: 

-In some embodiments, some of all of the techniques above can be combined to yield a 
metric that determines whether a flow should receive special treatment. 

Please replace the paragraph beginning at page 8, line 13, with the following rewritten 
paragraph: 

—In one embodiment of this invention, the precise placement of the Collector depends on 
whether it is implemented in the CP's DMZ, or next to the CP's border routers in a CoLo. In 
some embodiments, the Collector can include passive, fail-safe monitoring hardware, and it may 
be placed in the flow for all the outbound traffic (such as within a DMZ). In other embodiments, 
it may be required that all traffic that needs to be monitored will be diverted towards the 
Collector. (See below.) 

Please replace the paragraph beginning at page 15, line 15, with the following rewritten 
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paragraph: 

— Address Aggregation Policy: In some cases, scalability considerations of individual 
networking devices, and the system as a whole, result in desires to limit the number of address 
ranges to be managed. It order to keep the number of address ranges reasonable, defining 
"minimum set criteria" for address ranges is sometimes required. Examples of this case include 
"minimum set size of 255 addresses"; which is to say, addresses, and address ranges involving 
less than 255 addresses, will be aggregated into a single set. In some cases, Address Aggregation 
policy varies across the range of managed addresses. For convenience in identifying sets, Address 
Aggregation policy often is limited to ranges of contiguous addresses.— 

Please replace the paragraph beginning at page 15, line 15 with the following rewritten 
paragraph: 

—Administrative Policy may also encompass user-definable criteria.— 

Please replace the paragraph beginning at page 16, line 1, with the following rewritten 
paragraph: 

—Pre-Existing Address Range definitions may be useful in the Group definition process: 
the use of such definitions, if available, may increase the efficiency of bootstrapping the system, 
and may also allow the system to integrated more effectively with internal or external routing or 
forwarding devices. In some cases, Pre-Existing Address Range Definitions may map directly 
(1:1) to Groups; in other cases, a Group may include more than one of the existing Address 
Definitions. In some examples of this case, a source of routing table information may be 
identified as the reference source of Group Definition information. In some embodiments of this 
invention, Group Definitions are kept synchronized with a dynamic Reference Routing Table. -- 

Please replace the paragraph at page 17, line 30, with the following rewritten paragraph: 

— In some embodiments of this invention, it may be desirable to enforce a direct 1 : 1 
mapping between Group Definition and a Reference Routing Table.— 

Please replace the paragraph at page 1 8, line 11, with following rewritten paragraph: 

—In some embodiments of this invention, it may be desirable to allow Groups to refer to 
address ranges which were not present in the Reference Routing Table. In some cases, this may 
involve address ranges within Group definitions which are broader than those currently present in 
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the reference routing table.— 



Please replace the paragraph at page 24, line 4, with the following rewritten paragraph: 

— One other item regarding the metrics deals with their ordering. In some embodiments, 
Jitter and Delay can be merged. ~ 

Please replace the paragraph at page 25, line 6, with the following rewritten paragraph: 

— In one such implementation, each PoP will be equipped with an implementation of 
BGP. These BGP sessions should communicate with each other; in some implementations, all 
PoPs can peer in a full mesh of IBGP peerings. In other implementations where the number of 
PoPs is large so that a full mesh becomes impractical, BGP Route Reflection can be 
implemented. In such an infrastructure, each PoP can advertise routes to all EC's that it has 
monitored, giving an address within that PoP as the next hop. Most attributes in that BGP 
message can be left at default values; in some implementations, only the 32-bit.-- 

Please replace the paragraph at page 27, line 28 to page 28, line 4, with the following 
rewritten paragraph: 

—In some embodiments of this invention, the performance-based, application-specific 
metric derived above could be modified using other variables such as overall network usage, 
individual network link usage (absolute or relative) or link usage cost. For example, interface 
stats of network devices (e.g., netflow on routers) could be used to determine current load on all 
available links, from which an estimate of the cost can be computed. The performance-based 
metric can then be penalized to take into account cost factors. In some embodiments of this 
invention, these cost parameters can be manually entered/tuned by the user. In particular, in 
some embodiments, the user can explicitly penalize or favor given routes. 

Please replace the paragraph at page 45, line 28 to page 46, to line 2, with the following 
rewritten paragraph: 

— In some embodiments of the invention, the internetwork is implemented by a plurality 
of one or more subnetworks, including a plurality of one or more VPNs, a plurality of one or 
more BGP autonomous systems, a plurality of one or more local area networks, a plurality of one 
or metropolitan area networks, and a plurality of one or more wide area networks.— 

Please replace the paragraph at page 46, line 15, with the following rewritten paragraph: 
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—In some embodiments of the invention, the measurement packet sizes and times between 
measurement packets simulate the traffic pattern of a plurality of one or more applications. 

In the Claims: 

Please amend claim 93 as follows: 

93. (Amended) The method of claim 80, wherein the selecting, the creating, and the classifying 
are performed at a plurality of one or more distributed servers distributed through a plurality of 
one or more autonomous systems. 

REMARKS 

In light of the amendments set forth above, Applicants earnestly believe that they are 
entitled to a letters patent, and respectfully solicit the Examiner to expedite prosecution of this 
patent application to issuance. Should the Examiner have any questions, the Examiner is 
encouraged to telephone the undersigned. 
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Attached hereto is a marked-up version of the changes made to the specification by the 
current Preliminary Amendment. The attached page captioned " Version with markings to show 
changes made. " 



WILSON SONSINI GOODRICH & ROSATI 

650 Page Mill Road 

Palo Alto, CA 94304-1505 

(650) 493-9300 

Client No. 021971 



Respectfully submitted, 



Date: February 27, 2002 




Kenta Su^S^ 
Registration No. 45,145 
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VERSION WITH MARKINGS TO SHOW CHANGES MADE 
In the Specification : 

Please amend the paragraph beginning at page 1 , line 3 1 , to page 2, line 2, as follows: 

The performance aspects of network paths to any given address will often have similar 
characteristics of the network paths to a nearby address. However, the task of identifying address 
blocks which are acceptably similar in performance characteristic is subtle ^network address 
ranges are typically not directly representative of the underlying network topology. 

Please amend the paragraph beginning at page 7, line 6, as follows: 

In some embodiments of this invention, the device can select flows on the basis of input 
other than performance, such as user input, or the cost of the link. That is, the user can specify the 
flows that need special [treatement] treatment . Also, interface statistics can be obtained from 
network; using this input, quantities such as available bandwidth, cost of [usasge] usage of the 
links, or link bandwidth can be computed. Those skilled in the art can identify other metrics 
based on which flow determination and [treatement] treatment can be based. Flows can be 
diverted when a given threshold in such metrics (such as cost or available bandwidth) is detected. 

Please amend the paragraph beginning at page 7, line 15, as follows: 

In some embodiments, some of all of the techniques above can be combined to yield a 
metric that determines whether a flow should receive special [treatement] treatment . 

Please amend the paragraph beginning at page 8, line 13, as follows: 

In one embodiment of this invention, the precise placement of the Collector depends on 
whether it is implemented in the CP's DMZ, or next to the CP's border routers in a CoLo. In 
some embodiments, the Collector can include passive, fail-safe monitoring hardware, and it may 
be placed in the flow for all the outbound traffic (such as within a DMZ). In other embodiments, 
_ it may be required that all traffic that needs to be monitored will be diverted towards the 
Collector. (See below.) 
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Please amend the paragraph beginning at page 15, line 15, as follows: 

— Address Aggregation Policy: In some cases, scalability [consderations] considerations 
of individual networking devices, and the system as a whole, result in desires to limit the number 
of address ranges to be managed. It order to keep the number of address ranges reasonable, 
[definiting] defining "minimum set criteria" for address ranges is sometimes required. Examples 
of this case include "minimum set size of 255 addresses"; which is to say, addresses, and address 
ranges involving less than 255 addresses, will be aggregated into a single set. In some cases, 
Address Aggregation policy varies across the range of managed addresses. For convenience in 
identifying sets, Address Aggregation policy often is limited to ranges of contiguous addresses. 

Please amend the paragraph beginning at page 15, line 27, as follows: 

[Administritative] Administrative Policy may also encompass user-definable criteria. 

Please amend the paragraph beginning at page 16, line 1, as follows: 

Pre-Existing Address Range definitions may be [usefull] useful in the Group definition 
process: the use of such definitions, if available, may increase the efficiency of bootstrapping the 
system, and may also allow the system to integrated more effectively with internal or external 
routing or forwarding devices. In some cases, Pre-Existing Address Range Definitions may map 
directly (1 :1) to Groups; in other cases, a Group may include more than one of the existing 
Address Definitions. In some examples of this case, a source of routing table information may be 
identified as the reference source of Group Definition information. In some [emodiments] 
embodiments of this invention, Group Definitions are kept synchronized with a dynamic 
Reference Routing Table. 

Please amend the paragraph at page 17, line 30, as follows: 

In some embodiments of this invention, it may be desirable to [enfore] enforce a direct 
1:1 mapping between Group Definition and a Reference Routing Table. 

Please amend the paragraph at page 18, line 1 1, as follows: 

In some embodiments of this invention, it may be desirable to allow Groups to refer to 
address ranges which were [are] not present in the Reference Routing Table. In some cases, this 
may involve address ranges within Group definitions which are broader than those [currenly] 
currently present in the reference routing table. 
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Please amend the paragraph at page 24, line 4, as follows: 

One other item regarding the metrics deals with their ordering. In some embodiments, 
Jitter and Delay can be merged. [Many implementations exist, the details of which can be found 
in [CORE-STATS]. ( *** HERE ***)] 

Please amend the paragraph at page 25, line 6, as follows: 

In one such implementation, each PoP will be equipped with an implementation of BGP. 
These BGP sessions should communicate with each other; in some implementations, all PoPs can 
peer in a full mesh of IBGP peerings. In other implementations where the number of PoPs is large 
so that a full mesh becomes impractical, BGP Route Reflection can be implemented. In such an 
infrastructure, each PoP can advertise routes to all EC's that it has monitored, giving an address 
within that PoP as the next hop. Most attributes in that BGP message can be left at default values; 
in some implementations, only the3 2-bit. 

Please amend the paragraph at page 27, line 28 to page 28, line 4 as follows: 

In some embodiments of this invention, the performance-based, application-specific 
metric derived above could be modified using other variables such as overall network usage, 
individual network link usage (absolute or relative) or link usage cost. For example, interface 
stats of network devices (e.g., netflow on routers) could be used to determine current load on all 
available links, from which an estimate of the cost can be computed. The performance-based 
metric can then be penalized to take into account cost factors. In some embodiments of this 
invention, these cost parameters can be manually entered/tuned by the user. In particular, in 
some embodiments, the user can [explicitely] explicitly penalize or favor given routes. 
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Please amend the paragraph at page 45, line 28 to page 46, to line 2, as follows: 

In some embodiments of the invention, the internetwork is implemented by a plurality of 
one or more subnetworks, including a plurality of one or more VPNs, a plurality of one or more 
BGP autonomous systems, a plurality of one or more local area networks, a plurality of one or 
metropolitan area networks, and a plurality of one or [morewide] more wide area networks. 

Please amend the paragraph at page 46, line 15, as follows: 

In some embodiments of the invention, the measurement packet sizes and times between 
measurement packets simulate the traffic pattern of a plurality of one or more applications^ 

In the Claims: 

Please amend claim 93 as follows: 

93. (Amended) The method of claim 80, wherein the selecting, the creating, and the classifying 
[are] are performed at a plurality of one or more distributed servers distributed through a plurality 
of one or more autonomous systems. 
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